…And what processes does your organization need to make it successful?
If your organization has a whistleblowing system in place, it was likely implemented to protect your employees and enable them to report their concerns easily – and to help your organization identify and address risks.
Encouraging employees to speak up when they have an ethics and compliance question or concern creates a significant advantage for your organization. It means you have an early warning system in place that allows you to address potential issues before they escalate – and better protect your organization from reputational, financial and legal risk.
However, building a whistleblowing system that works well doesn’t happen overnight. An effective reporting system employees can easily use requires a number of key tools and processes in place. These include:
- Reliable phone and web reporting options
- An incident management system that captures, organizes and assigns issues effectively
- Clear policies
- Strong investigation processes and senior leaders who are committed to holding all employees to the organizations’ ethical standards
Here are some of the best whistleblowing process management tips for implementing a successful program.
Communicating with whistleblowing incident reporters
One essential element of a strong reporting system is often overlooked: communications with reporters and whistleblowers after they have logged their issue or concern, whether done anonymously or not. Here are some best practices for communicating with your reporters:
1. Make communications reporter-centric
When thinking about how to communicate with reporters, put yourself in their shoes. They may be upset, afraid, and pessimistic that their report will not be taken seriously. They may fear retaliation or other adverse outcomes, and still made the brave decision to speak up.
Make sure whoever is receiving these reports has an empathetic tone and expresses appreciation for their willingness to come forward. Make sure those conducting report intake tell the reporter what the next steps will be with the case and when to expect an update. These actions demonstrate you take their report seriously.
2. Protect confidentiality
Every named reporter trusts that their identity will be held in confidence during the reporting and investigation process. That means a reporter’s name will only be shared with those who need to know.
All parties involved in handling a report should understand this confidentiality requirement, but leaks do occur. The most common source of a leak is the reporter themselves. It is critical to inform everyone involved in a report, including the reporter, that names and details of the matter must be kept strictly confidential. To break this confidence can seriously damage the effectiveness of the reporting and investigation.
3. Provide regular updates
Reporters who are left in the dark with what is happening with a report are in a very difficult spot. The anxiety of not knowing can nag a reporter incessantly and employers should take steps to minimize this experience.
A good best practice is to communicate with reporting employees every one to two weeks, as appropriate. Whistleblowing and incident management software, includes a built-in “reminder” feature – a task management functionality that helps ensure investigators never miss a follow-up deadline.
4. Make sure anonymous reporters understand the need to follow up
Anonymous reporters need to understand their responsibility to follow-up on their initial report, especially during the first week – and what’s at stake if they don’t follow through. If investigators need more information to move forward with an inquiry and can’t get it, everyone loses.
You can help establish this expectation for follow-ups long before someone reports by making it part of your E&C training and awareness efforts. However, this directive also needs to be built into all anonymous reporting channels through messaging in the reporting interface itself.
5. Provide investigator/case manager contact information
Whether or not a reporter chooses to remain anonymous, many organizations provide the name and contact information of the investigator and/or the manager assigned to the case. This information provides a personal touch and helps reassure reporters someone is accountable for the investigation and managing the case process.
6. Make sure team interactions with reporters are tightly coordinated
Work to ensure consistency across all teams who might interact with whistleblowers – including management, ethics and compliance teams, legal and HR. Poor coordination gives reporters mixed messages or conflicting information, can undermine or derail the investigation process, and erodes whistleblower trust. In addition, it’s essential to make sure investigators are living up to the deadlines and expectations they’ve committed to.
7. Consider using (some) standardized messaging for whistleblower communications
While they can feel a bit less personal, standardized reporter communications can save valuable investigator time – and guarantee all reporter communications align with your messaging.
Organizations taking this approach typically create messages that cover the most common scenarios (response to initial report, notification the investigation is underway, notification the investigation has closed, etc.). Another upside to standardized messages is you can make sure they adhere to your policies and messaging.
8. Be clear about what can and cannot be shared with whistleblowers
Your legal department (or other leadership) may have specific rules regarding what information can and cannot be shared regarding the investigation – including disciplinary action taken. Whatever your organization decides, make sure your investigators and case managers are aware of the rules regarding reporter follow-up. Organizations should establish a consistent standard regarding what information they share.
9. Provide instructions for further follow-up and reporting after case closure
Whistleblowers should be notified when an investigation is complete, along with any information you can provide about the resolution. But they also need instructions about what to do if they have additional questions, believe their concern was not addressed or feel they have experienced retaliation.
While a whistleblower may be unhappy about the outcome of an investigation, it’s important to make it clear you are still willing to listen – and importantly, if retaliation is reported, take prompt action to address the behavior. This support reinforces your organization’s commitment to creating a strong culture of ethics.
10. Document all whistleblower-related interactions in a centralized incident management system
Centralizing all information – from the initial incident report to the final communication with the reporter – has a multitude of benefits. From a whistleblower’s perspective, working within an incident management system provides a more structured and predictable experience.
From the company’s perspective, it provides a defensible audit trail should there be any question about how the case was investigated and resolved. It is also an essential interface to enable communications with anonymous reporters.
11. Prevent and handle retaliation
Fear of retaliation is the number one reason employees don’t report compliance concerns. Managers need to understand and avoid behaviors that may be perceived by whistleblowers as retaliatory – for instance, not saying hello, excluding them from meetings, assigning a disproportionate amount of undesirable work, etc.
Also, monitor your work group for retaliation against an employee whom you know reported an issue and may be at high risk for reprisal. Best practice is to check in with the employee monthly for one to three months, then taper to quarterly check-ins for up to one year. If a manager detects retaliation, swift action should be taken.
12. Reinforce your core ethics and compliance program messages
Communication with reporters offers a great opportunity to emphasize key compliance messages and to further promote your organization’s commitment to ethics and compliance. Including key phrases and terminology from compliance messaging in your whistleblower follow-up shows your organization has a united mission.
For example, communications should emphasize they did the right thing by speaking up and acknowledging their action helps maintain a culture of integrity at your organization, while reinforcing the message your organization does not tolerate retaliation.
The benefits of whistleblowing – and reporting feedback – for your people
Introducing an internal reporting channel is only the beginning. The way you deal with reports once they’re raised is critical to your program’s overall success.
Providing feedback to people who raise a concern is a simple but effective way to demonstrate you operate a ‘speak-up’ culture that reflects important messages about treating every report appropriately.
1. It provides reassurance that it’s ok to speak up
Acknowledging a whistleblowing report provides confirmation it was received and read – and more importantly, that the information is valued. This is, in many cases, the simplest and most effective action you can take to reassure those who have taken the often-difficult step to raise a concern.
It also provides a signal to others who may have workplace concerns, through word of mouth, that whistleblowing is encouraged and taken seriously within the company.
Potential whistleblowers are often torn between wanting to do the right thing, while not wanting to experience retaliation, betray their colleagues or employer, or even lose their job.
Feedback is an important way of showing your stakeholders you value people who speak up about wrongdoing and take their concerns seriously.
2. It can prevent whistleblowers from going public
Acknowledging issues internally before someone decides to take their concerns to an external regulatory body, post on their social media network, or even speak to the press, should be a priority for every organization that values its reputation. These reports offer an opportunity to address the issue early will also help prevent further misconduct – a win-win for all.
Recent history is littered with examples of employees who tried to alert their superiors about unethical or illegal activities but who, when their concerns were ignored, chose to go public.
Organizations need to acknowledge the whistleblowing report and provide feedback, regardless of whether the report is substantiated. The acknowledgement and feedback the whistleblower receives is likely to create a connection and build trust between the employee and their speak-up program.
3. It can help build employee loyalty
Making employees and suppliers feel valued will not only help build an open culture within your company, but it may also increase their loyalty towards it.
Herzberg’s theory of motivation has shown that employees like to feel valued – and often find it more motivating than financial reward. He also found that when employees receive recognition or a sense of being valued, they can be an even greater asset to their organization.
This reinforces the idea that while a whistleblower doesn’t always have to be vindicated, providing feedback to let them know their report is being investigated shows they are valued. Further, keeping the employee updated throughout the process will give your whistleblowing system a positive reputation.
4. It can create a “word of mouth” effect
If people hear about a colleague’s positive experience, it may encourage others to come forward to reveal unethical behavior within the workplace. A poor experience will likely have the opposite effect and deter people from coming forward with crucial information.
By constructing a positive journey from beginning to end for the whistleblower, you’ll increase the chances that users will act as advocates for your whistleblowing system.
5. It encourages an open culture that retains talent
Delivering feedback will show you’re listening and that you do genuinely want to protect your employees and suppliers. In turn, this will give employees confidence in the process, and in challenging inappropriate behavior more openly.
A positive, ethical culture is a great way to differentiate yourself from your competitors. It takes commitment and energy, but building an open culture is a way of attracting and retaining talented and loyal employees.
6. It is a legal requirement for many organizations
There are a number or regulations requiring organizations to implement whistleblowing channels, establish protocols for investigation and follow up, and protections to whistleblowers from retaliation.
While not specifically created to protect whistleblowers, the Sarbanes-Oxley Act (SOX), was enacted in 2002 to curb accounting scandals. SOX safeguards employees who report financial wrongdoing, and while SOX doesn’t mandate specific whistleblowing channels, it protects individuals who report violations through internal channels or directly to regulators, preventing companies from retaliating against them. This regulation applies to publicly traded companies located in the United States.
The EU Whistleblower Protection Directive, which came into effect in 2021, includes an obligation for organizations to keep whistleblowers informed about their disclosure. Other requirements of the Directive include having reporting channels available in the public and private sector; protections for whistleblowers who can report internally or externally to regulators; confidentiality protections for reporters; prohibition of retaliation against reporters; follow up with reporters is required in a timely manner.
Each EU Member State has the option to extend the protections in their own transposition of the Directive into national law. For specific information on country-level requirements, you can refer to our guides that provide more details information.
Other laws may not be as comprehensive as the EU Directive, but more and more, other countries are adopting whistleblower protection legislation. For example, Japan’s whistleblower protection law, while not as comprehensive as some, offers limited safeguards for employees reporting misconduct within their companies. It protects whistleblowers from retaliation for reporting violations of specific laws, but the reporting channels and investigation procedures are often left to the discretion of the organization.
Remember: Remain objective
No matter how trivial a report may seem, it shouldn’t be ignored. It’s important to take reports seriously, not only from a whistleblower experience perspective, but also a risk management perspective.
Even seemingly “low-level” reports may represent a whistleblower testing the water before reporting a much more significant issue, or may even prove to be an important piece in an imminent or existing investigation.
Providing feedback helps keep people engaged in the process – something that could be vital during the evidence-gathering phase of an investigation.
Keep it simple and secure
The whistleblowing process should allow for individuals to remain anonymous, but still allow investigators at the other end to be able to provide feedback.
The feedback process should be consistent, as this will make the process quicker and more efficient for both the discloser and the investigator.
For example, NAVEX Whistleblowing & Incident Management solutions provide a secure mechanism through which identified or anonymous reporters can communicate with their organization about their report throughout the process.
Supporting whistleblowers builds trust and consistency
A whistleblowing solution is only one aspect of a risk and compliance program – albeit, a large one. Creating a program that prioritizes this important feedback, investigates reports and resolves issues consistently is paramount to compliance program success. In order to properly support whistleblowers and built trust in the program, it’s critical to ensure you have the appropriate tools, personnel and funding allocated to your program so every report you receive results in a meaningful response.
To best manage whistleblower reports, a comprehensive whistleblowing intake and incident management system helps automate initial acknowledgement, streamline the feedback and dialogue process, and build trust in your workplace whistleblowing process.
Ready to learn how NAVEX solutions can help you build a reliable whistleblowing and incident management program?
